In the past I had to do several DoS security audits, with múltiples types of tests and intensities. Sometimes several DDoS protections were present like Akamai for static content, and Arbor for absorb part of the bandwith.
One consideration for the DoS/DDoS tools is that probably it will loss the control of the attacker host, and the tool at least has to be able to stop automatically with a timeout, but can also implement remote response checks.
In order to size the minimum mbps needed to flood a service or to retard the response in a significant amount of time, the attacker hosts need a bandwith limiter, that increments in a logarithmic way up to a limit agreed with the customer/isp/cpd.
There are DoS tools that doesn't have this timeouts, and bandwith limit based on mbps, for that reason I have to implement a LD_PRELOAD based solution: bwcontrol
Although there are several good tools for stressing web servers and web aplications like apache ab, or other common tools used for pen-testing, but I also wrote a fast web flooder in c++ named wflood.
As expected the most effective for taking down the web server are the slow-loris, slow-read and derivatives, few host were needed to DoS an online banking.
Remote attacks to database and highly dynamic web content were discarded, that could be impacted for sure.
I did another tool in c++ for crafting massive tcp/udp/ip malformed packets, that impacted sometimes on load balancers and firewalls, it was vulcan, it freezed even the firewall client software.
The funny thing was that the common attacks against Akamai hosts, where ineffective, and so does the slow-loris family of attacks, because are common, and the Akamai nginx webservers are well tunned. But when tried vulcan, few intensity was enough to crash Akamai hosts.
Another attack vector for static sites was trying to locate the IP of the customer instead of Akamai, if the customer doesn't use the Akamai Shadow service, it's possible to perform a HTTP Host header scan, and direct the attack to that host bypassing Akamai.
And what about Arbor protection? is good for reducing the flood but there are other kind of attacks, and this protection use to be disabled by default and in local holidays can be a mess.
Related posts
- Hacking Tools 2020
- Pentest Recon Tools
- Top Pentest Tools
- Hacker Tools 2020
- Hacker Tool Kit
- Ethical Hacker Tools
- Hacker Security Tools
- Pentest Tools List
- Hacker Tools 2020
- Hacker Tools 2019
- Hack Tools For Windows
- Hacking Tools Software
- Pentest Tools Website Vulnerability
- Hacker Tool Kit
- Hacker Tools Mac
- Nsa Hacker Tools
- Hacker Tools For Mac
- Pentest Tools Nmap
- Best Pentesting Tools 2018
- How To Hack
- Beginner Hacker Tools
- Hacking Tools Mac
- Hacking Tools 2019
- Computer Hacker
- New Hacker Tools
- Hacker Tools Online
- Pentest Tools Open Source
- Hack And Tools
- Game Hacking
- Bluetooth Hacking Tools Kali
- Pentest Reporting Tools
- Pentest Recon Tools
- Hack App
- Hack Tools
- Hacker Techniques Tools And Incident Handling
- Computer Hacker
- Github Hacking Tools
- Tools For Hacker
- Hak5 Tools
- Beginner Hacker Tools
- Pentest Tools Url Fuzzer
- Game Hacking
- Tools For Hacker
- Hacking Tools Windows
- Hack Tools Mac
- Termux Hacking Tools 2019
- Pentest Tools For Android
- Hacking Tools For Windows
- Android Hack Tools Github
- Game Hacking
- Pentest Tools Find Subdomains
- Pentest Tools Website Vulnerability
- Pentest Box Tools Download
- Hack App
- Hacker Tools List
- Hacking Tools Usb
- Bluetooth Hacking Tools Kali
- Easy Hack Tools
- Hacker Tools
- Nsa Hacker Tools
- Hacking Tools Hardware
- Hacking Tools For Windows 7
- Pentest Tools Apk
- Android Hack Tools Github
- What Is Hacking Tools
- What Is Hacking Tools
- Tools Used For Hacking
- Hacker Tools
- Hak5 Tools
- Blackhat Hacker Tools
- Hacker Tools Mac
keyword:art gallery, gallery, fantasy art, landscape art, nude, abstract art, fine art, wall art, art, artwork, painting, oil painting, landscape painting, buy art,art daily,art news,artdaily, daily art, art newspaper, arte, arts daily,contemporary art news,fine art news,the art daily,art news daily,art daily news,daily newsletter,artdaily.org, artdaily.com, art site, art news, art of the day, art daily, museums, Pavarotti, exhibits, artists, milestones, digital art, architecture, photography, photographers, special photos, special reports, featured stories, auctions, art fairs, anecdotes, art quiz, education, mythology, 360 images, 3D images, last week, ignacio villarreal, The First Art Newspaper on the Net, The First Art, Newspaper
0 comments:
Post a Comment